← Back

CVE-2026-44441

nvd nist
Published: May 13, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.

Affected (2)

Products: Frappe: Erpnext
Frappe
1 product
Erpnext
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Frappe
Erpnext
Before 15.106.0
Erpnext
From 16.0.0 to 16.16.0

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.